A broken access control issue allows any user with a subscriber role to perform privileged actions normally reserved for administrators, leading to potential unauthorized configuration changes or disclosure of sensitive data. The vulnerability is classified as CWE‑862, indicating a failure of proper role‑based access enforcement.

The problem resides in the Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin developed by Sheikh Heera. All releases through and including version 1.51.0 are affected; the fix is available in version 1.51.1 and later.

The CVSS base score of 8.1 highlights the high severity of this flaw. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely publicized exploits yet. Based on the description, it is inferred that an attacker must first acquire or create a subscriber account—possible through normal registration or phishing—to access the vulnerable plugin functions. Once the subsystem is reached, the attacker could alter plugin settings or expose confidential information, compromising site integrity.